General
- Target TNT AWB 9066721066.exe
- Size 878KB
- Sample210712-sp4grsd78x
- SHA256 69bd3426cb69349ccb68b8ff641f05c51931a7c8a3d563c0234eab905535e031
- MD5 b7915ca5ea922d853ee7e8f74a72f20d
- SHA1 d115dc4d73d20d2ec5a89c038f903ff26339cc72
- SHA512 72db76f9e90faa9a3e5c8328c4d4c3638fd4c3c258bd1d22d2c1b5d9585e8723d7038d2db08d7e81cab8f58e53aad46d786636871f07fd9912189a46687394c5
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
TNT AWB 9066721066.exe
Resource
win7v20210408
Malware Config
Extracted
-
xloader
-
2.3
-
http://www.xn--vcsr9nd2hesf.com/g820/
-
bitglassqafr-qa.com
-
lotstech.com
-
baizdm.com
-
techosbienesraices.com
-
theaspiresports.com
-
abiaofashion.com
-
doonokthai.com
-
acpmreviewtext.com
-
subskription.net
-
baderaum.com
-
054ioyt.com
-
askmelaptop.com
-
cashpaymentus.com
-
superstaybrooklynbronze.com
-
shop-elektro.com
-
vitaformalisboa.com
-
revealrepatterncoaching.com
-
homesbymariet.com
-
kjfdjjkdfefjefd.com
-
memorymanagersindex.com
-
livingbiophilic.com
-
signsall.graphics
-
bellevuemeribel.com
-
4895rwi.com
-
oasisuniverse.net
-
apackagingmachine.com
-
tiaret.online
-
carinasglossyclaws.com
-
ahoori.com
-
bongda8live.win
-
ths1m.com
-
mylifeinsurancetips.com
-
gobesttobuy.com
-
fundacionpolitica.com
-
kingdomcarsunlimited.com
-
y0byblak.com
-
kazukasegu.com
-
particlevitamins.com
-
distributehate.com
-
xn--80ahegeiiwjjl1a.xn--p1acf
-
divaofsweden.com
-
she-consulting.uk
-
tintaalairelibre.com
-
domesticaupair.com
-
shuttlepost.com
-
staycalmwebuyhouses.com
-
belgraderunning.guru
-
arizonaluxurydreamhome.com
-
transactie-authencatie.site
-
rgetion.com
-
chocolateriamexicana.com
-
irepairie.com
-
lsdf88.com
-
dayanierafael.com
-
cunix88.com
-
crazypirategames.com
-
youwatchfreemovie.com
-
sterilelite.com
-
annmvnila.icu
-
lpgburnersau.com
-
elvator.com
-
magazzinilineablu.com
-
naulafashion.com
-
ggjckrasnnn.com
Targets
-
- Target TNT AWB 9066721066.exe
- Size 878KB
- SHA256 69bd3426cb69349ccb68b8ff641f05c51931a7c8a3d563c0234eab905535e031
- MD5 b7915ca5ea922d853ee7e8f74a72f20d
- SHA1 d115dc4d73d20d2ec5a89c038f903ff26339cc72
- SHA512 72db76f9e90faa9a3e5c8328c4d4c3638fd4c3c258bd1d22d2c1b5d9585e8723d7038d2db08d7e81cab8f58e53aad46d786636871f07fd9912189a46687394c5
- MD5 SHA1 SHA512
Xloader Payload
Deletes itself
Suspicious use of SetThreadContext